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(Step 1: C requests a connection to S (protected login, URL, link, etc.) 
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- KStep 2: SRKi is sent to C; communication interface is established 
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- KStep 3: C enters user (host) name, user (host ID) and server password on C side ~) + 
R 3007T7 S 



- KStep 4: User (or host) name hashed and encrypted with SRKi is sent to S 
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tep 5: If user (or host) is validated, S sends to C DRK1 encrypted with SRKi; 
decrypts DRK1 with SRKi and sends to S encrypted with DRK1 hashed DRK1 
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/Step 6: If received DRK1 is correct, S sends to C DRK2 encrypted with DRK1 ; *\ 
~*\Q decrypts DRK2 with DRK1, and sends to S encrypted with DRK2 hashed DRK2 J T 



S.R 

r-K. . . . 



3010-^ 



R.S 



> 



S, R 



3011 



R,S 



tep j: If received DRKj-1 is correct, S sends to C DRKj encrypted with DRK(j-1); 
decrypts DRKj with DRK(j-1 ) and sends to S encrypted with DRKj hashed DRKj 
S.R 3012 R.S 
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/Step n: If received from C DRKn-1 is correct, S sends to C DRKn encrypted with the ^ 

hashed user password as a key; C decrypts DRKn with the user password, stored at 

C in step 3, and converted to its hash equivalent; then C sends to S hashed DRKn 

encrypted with the user password, stored at C in step 3, and converted to its hash 

Equivalent. w 

S,R 3014—* R,S 

/Step n+1 : If hashed DRKn received in step 3014, and decrypted with hashed user N 

password is correct, S sends to C DRKn encrypted with hashed server password as 

a key; C decrypts DRKn with the server password, stored at C in step 3, and 

converted to its hash equivalent; if hashed DRKn is the same as DRKn from step 

V 30H then C sends to S hashed DRKn encrypted with the hashed server password.^ / 

5 3015 ^> R 
^ N 

Step n+2: If received from C DRKn is correct/wrong, then authentication signal go/no 
encrypted with DRKn-1, is sent to C; C decrypts the go/no signal with DRKn-1, stored 
at C in step 3013. This completes C/S mutual authentication and the Final Secret Key 

(FSK) exchange according to the KEDIA algorithm. , 
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Ktep 6: If received DRK1 is correct, S sends to C DRK2 encrypted with DRK1 ; C N 
ecrypts DRK2 with DRK1, and sends to S encrypted with DRK 2 hashed DRK2 J r~ 
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sends to C DRK2 encrypted with 
|RK1 



4001 * ^ 



DRK 2 supplied by Server DRK 
Generator 2005 (FIG. 2) 
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Server supplies the assumed user 
password to enable bytes, bits, or 
bytes & bits veiling in DRK2 
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ByteVU, BitVU. or BBVU is applied to 
veil either bytes, or bits, or bytes & 
bits of DRK2 
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Conversion array, encrypted with 
DRK1 (block-cipher encryption 
algorithm), is sent to client 
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C decrypts DRK2 with DRK1, and 
sends to S encryted with DRK2 
V, hashed DRK2 
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Conversion array is decrypted with 
DRK1 (block-cipher encryption/ 
decryption algorithm) 

^4004 



Client supplies the user password 
triggering bytes, or bits, or bytes & bits 
reassembling in the conversion array 
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ByteVU, BitVU, or BBVU is 
reassembling the coversion array, 
decrypted before with DRK 1 



DRK 2 is reconstructed to its original 
form, and C sends to S hashed DRK2, 
treated with either ByteVU, BitVU, or 
BBVU; the final conversion array is 
encrypted with DRK 2 
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DRKi - 1 6 bytes 
| xhl | xh2 | xh3 | xh4 1 xh5 | xh6 | xh7 | ... | xhl4 1 xhl5 | xhl6 1 
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SEED (SERVER SIDE) 
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CLIENT SEQUENTIAL RANDOM 
NUMBER GENERATOR (SRNG) 
WITH USER PASSWORD AS A 
SEED (CLIENT SIDE) 
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1 &1 BBVU conversion array section; length - 10 bytes 
rl.l 1 r!2 | rl,3 1 xhl I r1,5 [ rl,6 | rl,7 [ r),8 | rl,9 | r1,10| 
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2 nd BBVU conversion array section; length - 10 bytes 
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| r2,l ( r2,2 | r2 ? 3 | r2,4 | r2,5 | r2,6 I r2,7 | r2,8 ( xh2 | r2 s 10 
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1 5 th BBVU conversion array section; length - 10 bytes 



rl5,l | xh!5 | rI5,3 | r!5,4 ] ... | r!5,7 1 r!5,8 | rl5,9 1 rl5,10 



16 th BBVU conversion array section; length - 10 bytes 
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r!61 1 r!6,2 | r!6,3 | ... | rl6,6 1 xh!6 1 rI6,8 | rl6,9 | r!6,I0 1 
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DRK.i - 128 bits 

| yhl | yh2 j yh3 | yh4 1 yh5 | yh6 | yh7 1 ... | yh!26 1 yhl27 | yh!28 1 
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CLIENT SKQUHN TIAL RANDOM 
NUMBER GENERATOR (SRNG) 
WITH USER PASSWORD AS A 
SEED (CLIENT SIDE) 
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I st BBVU conversion array section; length - 128 bits 
r1,1 | r1,2 | r1,3 | yhl jr.,5 r1,126 1 H,127 1 rl,128 1 
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I r2,l t r2,2 | r23 [ r2,4 [ r2 ? 5 | ... | r2,126 [ yh2 | r2,128 [ 
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127 th BBVU conversion array section; length - 128 bits 
rl27,l j r!27,2 | ti27,3 | yh!27 |rl27,5 r!27 t 127 1 rl27,128 | 



128 th BBVU conversion array section; length - 1 28 bits 
| rl28,l | yhl28 | rl28,3 |...| r!28J26 1 r!28,127 | r!28,128 
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DRKi - 16 bytes 
xhl | xh2 ( xh3 | xh4 1 xh5 | xh6 1 xh7 |.,.| xh!4 | xh15 | xh!6 
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NUMBER GENERATOR (SRNG) 
WITH USER'S PASSWORD 
AS A SEED 
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CLIENT SEQUENTIAL REVERSE 
BIT POSI TION SCRAMBLER 
(SRBPS) FOR EACH 
VEILED DRKi BYTE 
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CLIENT SEQUENTI AL RANDOM 
NUMBER GENERATOR (SRNG) 
WI TH USER'S PASSWORD 
AS A SEED 
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, 1 st BBVU conversion array section; length - 10 bytes 
. n , • 

| rLJ | r!2 1 rl,3 j xh"1 | rl,5 | r1,6| rl,7 | r1,8 | rl,9 [rLJOJ 



DRKi first xhl byte in binary bit representation: 
| xhl,8 | xhl ,7 | xhl ,6 | xhl,5 f xhl ,4 | xhl,3 | xhl,2 | xhlj 

(for instance, 0101 11 0 1 ) _____ 



Server's SRNG generates random sequence of 16 numbers from 1 to 10 
(due to ten positions in one BBVU conversion array section), and then the 
server's SBPS scrambles all bit positions in the veiled byte. 



For instance, the 1 st number generated by SRNG is 4 (DRKi 1 st byte position 
in the l 5t BBVU conversion array section above), then SBPS generates for 
each bit inside the DRKi 1 w byte new positions 3,1,8, 5, 4, 2, 7, 6 
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New positions for each bit from \ u to 8 th of xh l byte inside l &t BBVU 
conversion array section are 1101 1 100 for the example above, 
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